Vulnerability · Published Sep 10, 2021 · Assigned by GitHub_M

CVE-2021-39207Deserialization of Untrusted Data in parlai

High 8.4

In plain English

A high-severity unsafe deserialization in ParlAI from facebookresearch. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 79% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.4High

Exploit odds (30 days)1.8%top 21.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

parlai is a framework for training and evaluating AI models on a variety of openly available dialogue datasets. In affected versions the package is vulnerable to YAML deserialization attack caused by unsafe loading which leads to Arbitary code execution. This security bug is patched by avoiding unsafe loader users should update to version above v1.1.0. If upgrading is not possible then users can change the Loader used to SafeLoader as a workaround. See commit 507d066ef432ea27d3e201da08009872a2f37725 for details.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	parlai	1.1.0	GHSA-m87f-9fvv-2mgg
PyPI	parlai	1.1.0	GHSA-mwgj-7x7j-6966
PyPI	parlai	1.1.0	PYSEC-2021-330
PyPI	parlai	1.1.0	PYSEC-2021-334

Affected products (as reported)

Vendor	Product	Versions
facebookresearch	ParlAI	< 1.1.0

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L

References

https://github.com/facebookresearch/ParlAI/security/advisories/GHSA-m87f-9fvv-2mgg x_refsource_CONFIRM
https://github.com/facebookresearch/ParlAI/commit/4374fa2aba383db6526ab36e939eb1cf8ef99879 x_refsource_MISC
https://github.com/facebookresearch/ParlAI/commit/507d066ef432ea27d3e201da08009872a2f37725 x_refsource_MISC